{"id":"CVE-2025-47403","title":"Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.","summary":"Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-126","CWE-125"],"vendor":"qualcomm","product":"snapdragon_x65_5g_modem-rf_firmware","affected":["snapdragon_x65_5g_modem-rf_firmware","snapdragon_x72_5g_modem-rf_firmware","snapdragon_x75_5g_modem-rf_firmware","srv1h_firmware","srv1m_firmware","sxr2230p_firmware","sxr2250p_firmware","sxr2330p_firmware","sxr2350p_firmware","trestles_firmware","wcd9340_firmware","wcd9370_firmware","wcd9371_firmware","wcd9375_firmware","wcd9378_firmware","wcd9378c_firmware","wcd9380_firmware","wcd9385_firmware","wcd9390_firmware","wcd9395_firmware","wcn3950_firmware","wcn3988_firmware","wcn6450_firmware","wcn6650_firmware","wcn6755_firmware","wcn7760_firmware","wcn7860_firmware","wcn7861_firmware","wcn7880_firmware","wcn7881_firmware","wsa8810_firmware","wsa8815_firmware","wsa8830_firmware","wsa8832_firmware","wsa8835_firmware","wsa8840_firmware","wsa8845_firmware","wsa8845h_firmware","wsa8850_firmware","wsa8850w_firmware","ar8035_firmware","cologne_firmware","cq7790_firmware","cq8725s_firmware","cq8750m_firmware","csr8811_firmware","fastconnect_6200_firmware","fastconnect_6700_firmware","fastconnect_6900_firmware","fastconnect_7800_firmware","fwa_gen_3_ultra_firmware","fwa_gen_5_elite_firmware","g2_gen_1_firmware","g3x_gen_2_firmware","immersive_home_214_firmware","immersive_home_216_firmware","immersive_home_316_firmware","immersive_home_318_firmware","immersive_home_3210_firmware","immersive_home_326_firmware","ipq5010_firmware","ipq5028_firmware","ipq5300_firmware","ipq5302_firmware","ipq5312_firmware","ipq5332_firmware","ipq6000_firmware","ipq6010_firmware","ipq6018_firmware","ipq8076_firmware","ipq8078_firmware","ipq9008_firmware","ipq9554_firmware","ipq9570_firmware","ipq9574_firmware","iqx5121_firmware","iqx7181_firmware","kobuk_firmware","lemans_au_lgit_firmware","lemansau_firmware","marina_firmware","milos_firmware","milos_iot_firmware","molokai_firmware","netrani_firmware","qca8084_firmware","qca8085_firmware","qca8337_firmware","qca8386_firmware","qca8695au_firmware","qca9888_firmware","qca9889_firmware","qcc2073_firmware","qcc2076_firmware","qcc710_firmware","qcf8000_firmware","qcf8001_firmware","qcm4490_firmware","qcm5430_firmware","qcm6490_firmware"],"published":"2026-05-04","updated":"2026-09-30","sourceUpdated":"2026-09-30T22:10:00.273","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-47403","references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html","label":"product-security@qualcomm.com"}],"tags":["nvd"],"epss":0.00216,"epssPercentile":0.10833,"ingestedAt":"2026-09-30T22:27:27.776Z","slug":"CVE-2025-47403","body":"## Overview\n\nTransient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.\n\n## Affected\n\n- `snapdragon_x65_5g_modem-rf_firmware`\n- `snapdragon_x72_5g_modem-rf_firmware`\n- `snapdragon_x75_5g_modem-rf_firmware`\n- `srv1h_firmware`\n- `srv1m_firmware`\n- `sxr2230p_firmware`\n- `sxr2250p_firmware`\n- `sxr2330p_firmware`\n- `sxr2350p_firmware`\n- `trestles_firmware`\n- `wcd9340_firmware`\n- `wcd9370_firmware`\n- `wcd9371_firmware`\n- `wcd9375_firmware`\n- `wcd9378_firmware`\n- `wcd9378c_firmware`\n- `wcd9380_firmware`\n- `wcd9385_firmware`\n- `wcd9390_firmware`\n- `wcd9395_firmware`\n- `wcn3950_firmware`\n- `wcn3988_firmware`\n- `wcn6450_firmware`\n- `wcn6650_firmware`\n- `wcn6755_firmware`\n- `wcn7760_firmware`\n- `wcn7860_firmware`\n- `wcn7861_firmware`\n- `wcn7880_firmware`\n- `wcn7881_firmware`\n- `wsa8810_firmware`\n- `wsa8815_firmware`\n- `wsa8830_firmware`\n- `wsa8832_firmware`\n- `wsa8835_firmware`\n- `wsa8840_firmware`\n- `wsa8845_firmware`\n- `wsa8845h_firmware`\n- `wsa8850_firmware`\n- `wsa8850w_firmware`\n- `ar8035_firmware`\n- `cologne_firmware`\n- `cq7790_firmware`\n- `cq8725s_firmware`\n- `cq8750m_firmware`\n- `csr8811_firmware`\n- `fastconnect_6200_firmware`\n- `fastconnect_6700_firmware`\n- `fastconnect_6900_firmware`\n- `fastconnect_7800_firmware`\n- `fwa_gen_3_ultra_firmware`\n- `fwa_gen_5_elite_firmware`\n- `g2_gen_1_firmware`\n- `g3x_gen_2_firmware`\n- `immersive_home_214_firmware`\n- `immersive_home_216_firmware`\n- `immersive_home_316_firmware`\n- `immersive_home_318_firmware`\n- `immersive_home_3210_firmware`\n- `immersive_home_326_firmware`\n- `ipq5010_firmware`\n- `ipq5028_firmware`\n- `ipq5300_firmware`\n- `ipq5302_firmware`\n- `ipq5312_firmware`\n- `ipq5332_firmware`\n- `ipq6000_firmware`\n- `ipq6010_firmware`\n- `ipq6018_firmware`\n- `ipq8076_firmware`\n- `ipq8078_firmware`\n- `ipq9008_firmware`\n- `ipq9554_firmware`\n- `ipq9570_firmware`\n- `ipq9574_firmware`\n- `iqx5121_firmware`\n- `iqx7181_firmware`\n- `kobuk_firmware`\n- `lemans_au_lgit_firmware`\n- `lemansau_firmware`\n- `marina_firmware`\n- `milos_firmware`\n- `milos_iot_firmware`\n- `molokai_firmware`\n- `netrani_firmware`\n- `qca8084_firmware`\n- `qca8085_firmware`\n- `qca8337_firmware`\n- `qca8386_firmware`\n- `qca8695au_firmware`\n- `qca9888_firmware`\n- `qca9889_firmware`\n- `qcc2073_firmware`\n- `qcc2076_firmware`\n- `qcc710_firmware`\n- `qcf8000_firmware`\n- `qcf8001_firmware`\n- `qcm4490_firmware`\n- `qcm5430_firmware`\n- `qcm6490_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}